The Importance of Reporting Suspicious Activity

The terrorist attacks on September 11, 2001 marked a dramatic escalation of terrorist 

activity around the world and signified an alarming trend toward the targeting of civilians. The 

attacks on the World Trade Center and the Pentagon in 2001 represented the first suicide attacks 

successfully executed by international terrorists in the United States since the first bombing of 

the World Trade Center in 1993. Since 2001, few people have been surprised to see violent 

incidents occur worldwide, which have left tens of thousands of innocent people dead or 

wounded. Terrorist attacks have been reported on almost a daily basis, and have included active 

shooter assaults, suicide bombings, attacks with vehicles, hostage incidents, vehicle bombings, 

machete attacks, and beheadings. Recent worldwide events underscore the serious threat 

terrorism poses to the world, especially to the United States. 

 History has demonstrated that terrorists or other threat actors typically conduct certain 

activities prior to executing their attacks. Such activities are often suspicious in nature and 

include, but are not limited to photography, videography, observation/surveillance, 

misrepresentation, theft, sabotage, tampering, making expressed or implied threats, suicidal 

behavior, testing or probing security, questioning/elicitation, materials acquisition and 

operational rehearsals. These type activities are part of terrorist planning cycles and are 

important for us to recognize because it is during such activities that terrorists are most 

vulnerable to detection and apprehension. These pre-attack activities directly expose threat 

actors to the public and provide invaluable insight of their intended targets, thus representing the 

best opportunity for their malicious plots to be disrupted. In recent U.S. history, several deadly 

incidents serve as profound examples of violent acts that were precipitated by pre-attack 

activities such as those described above. 

 (New York City on 9/11) (The Pentagon on 9/11) (United Flight 93 Crashed in PA on 9/11) 

Prior to the 9/11 attacks on the World Trade Center and the Pentagon, terrorist hijackers 

enrolled in flight training schools in the U.S. Some of the hijackers participated in extensive 

flight simulator training and learned how to fly jetliners over major U.S. cities. Oddly enough, 

these eventual hijackers told flight instructors they only wanted to receive simulator training on 

flying over major metropolitan areas, such as Washington, D.C. and New York City. The 

hijackers expressed absolutely no interest in learning to take off or land the jumbo jets they 

claimed to want to fly professionally. Despite being such an odd request, flight instructors 

accommodated their desires. Adding to the suspicious nature of their activities, the hijackers 

paid for all flight lessons and simulator time in cash while other students paid with credit cards, 

grant checks or personal checks. 
In August 2001, four Middle-Eastern males were observed engaging in suspicious 

activity on an American Airlines flight from Boston to Los Angeles. The males were observed 

recording times between take-off, cruising altitude and when the seatbelt lights were turned off. 

At different times, the males were observed walking from their seats to the area of the cockpit 

door, turning around and walking back to their seats in first class. While each of the males took 

turns in this activity, the others looked around to determine if anyone 

was watching them. During the flight, one first-class passenger observed 

the suspicious activity and reported it to a flight attendant and to the 

flight’s First Officer. Although a complaint was made to the Federal 

Aviation Administration (FAA), no report of the incident was ever made 

to law enforcement until after September 11, 2001. Investigation later 

revealed that among the suspicious males on the August flight was lead 

9/11 hijacker Mohammed Atta. (Mohammed Atta) 

Another deadly incident that was precipitated by suspicious activity occurred on 

November 5, 2009 at Fort Hood, Texas. While in the Soldier Readiness Center at Fort Hood, 

U.S. Army Major Nidal Hasan shouted religious words in Arabic and opened fire with a pistol, 

killing 13 and wounding 32 others. Prior to the shooting, Hasan engaged in pre-attack activity 

behavior, some of which was very disturbing. Despite being a member of the U.S. Armed 

Forces, Hasan had openly expressed anti-American views and criticized the wars in Iraq and 

Afghanistan. Hasan had also expressed radical religious views and exchanged numerous emails 

with Anwar al-Awlaki, a senior recruiter and operations planer for the Islamist terrorist 

organization al-Qaeda. In a briefing to fellow Army Officers intended 

to be of a medical nature, Maj Hasan referred to al-Qaeda as “us,” 

including himself with the terror group. In the same briefing, Hasan 

referred to non-Islamists as “infidels.” According to one witness, Hasan 

tried to give away many of his prized possessions in the days prior to the 

attack. Several complaints were made about Hasan’s behaviors, but the 

complaints unfortunately were widely ignored. 

 (U.S. Army Maj Nidal Hasan) 

Pre-attack activities were also evident in the case of the San Bernardino, California 

attacks on December 2, 2015. Targeting a San Bernardino County Department of Public Health 

Christmas party, married couple Syed Farook and Tashfeen Malik used semi-automatic pistols 

and rifles to fatally shoot 14 people and seriously wound 22 others. Investigation revealed both 

Farook and Malik had been consumers of Islamic extremist propaganda and had contacted 

foreign terrorist organizations. Investigation further revealed that Farook and Malik routinely 

had unknown persons deliver boxes and packages to them at their residence during odd hours. A 

search of the residence after the December 2, 2015 attack yielded the recovery of more than 4500 

rounds of ammunition. Bomb making tools, hundreds of pieces of pipe and more than a dozen 

homemade pipe bombs were found in the garage. Investigation later revealed that in the weeks 

leading to the San Bernardino attack, Farook and a close friend discussed carrying out a shooting 

attack on a local college. The same friend ultimately purchased the assault rifles for Farook that 

were used in the shooting attack at the Christmas party. 
After the San Bernardino attack, a neighbor reported to Police that Farook and Malik 

often had suspicious persons at their residence at all hours of the night and that some type of 

construction or assembly project seemed to be ongoing in the garage while those persons were 

present. Rudolph Giuliani, the Mayor of New York City when the 9/11 attacks occurred, is also

a former United States Attorney for the Southern District of New York. Due to his specialized 

experience in terrorism prosecutions, Giuliani is widely 

renown as an expert in domestic and international 

terrorism. After details of the San Bernardino attack 

emerged, Giuliani emphasized the necessity of reporting

suspicious activity by stating, "Maybe it could have been 

avoided if the neighbor had reported the suspicious 

activity in the garage. Why didn’t she report it? She 

was afraid of being politically incorrect.” (Syed Farook) (Tashfeen Malik)

Prior to the June 12, 2016 attack on the Pulse Night Club in Orlando, Florida, shooter 

Omar Mateen had participated in multiple pre-attack activities. Mateen, who fatally shot 49 

people dead and seriously wounded 53 others inside the Pulse, had been investigated by the FBI

in 2013 for openly claiming to be a member of the Islamist militant group Hezbollah and having

connections to al-Qaeda. Mateen also claimed to have connections to Maj Nidal Hasan and to 

the Boston Marathon bombers. In 2014, the FBI investigated Mateen after discovering a link

between Mateen and an American radical Islamist who committed a suicide bombing in Syria.

During the time Mateen was employed as a security guard, he talked to co-workers about killing 

people and expressed open hatred for segments of the American population. In May 2016, 

Mateen entered a gun store in South Florida and asked about purchasing 

“heavy-duty law enforcement style body armor” along with bulk 

ammunition, both of which were refused by the store owner. From a 

different store, Mateen later purchased a rifle and semi-automatic handgun 

that he used in the Pulse Night Club attack. In the days and weeks before 

the attack, Mateen made multiple trips to the Pulse to perform surveillance. 

On the morning of the attack, Mateen posted to social media, “In the next 

few days, you will see attacks from the Islamic State (ISIS) in the USA.” 

(Omar Mateen) 

It is reasonable to believe not all pre-attack activities leading to the aforementioned tragic 

incidents could have been detectable by the public or law enforcement. If discovered, such 

suspicious activities would likely have exposed the assailants’ intentions and attack 

methodologies, ultimately leading to the arrest of many or all those involved in the terror 

schemes. Understanding the significance of pre-attack activities and how they relate to terror 

plotting can provide citizens with a heightened sense of awareness and reinforce the appropriate 

mindset necessary to detect and help prevent violent incidents. 

The FBI has indicated there are active terrorism investigations in all 50 states in the U.S. 

Although the exact number of Virginia terrorism investigations is classified, it is reasonable to 

assume the number is relatively high due to the multitude of potential high-value terror targets in 

Virginia. Our state is also home to dozens of vital government and military complexes, on which 

our enemies and international threat actors have actively sought intelligence. 
While no terrorist attacks have occurred in Virginia in recent years, it is important to 

understand the nature of the terrorism threat in our state. Regrettably, Virginia is among the 

states with the highest number of law enforcement encounters with persons confirmed to be on 

U.S. Terrorist Screening Center watch lists. Suspicious activity incidents, many of which are 

consistent with pre-attack activities, are consistently reported in high volumes across the state. 

To understand the potential for terrorist activity in Virginia, we only have to examine the 

nature of suspicious activities that are taking place. Over the past six months, the following 

suspicious activities have been reported within Virginia: 

• Surveillance (photography/videography) of critical infrastructure, including

transportation systems, bridges, airports and shipyards

• Surveillance (photography/videography) of government facilities, including

military facilities

• Tampering with power facilities, including power stations and power lines

• Elicitation (collecting information through questioning; also known as

requirement gathering) on transportation systems and government facilities

• Radicalized persons making attempts or expressing intent to join FTOs to fight

overseas in locations such as Iraq and/or Syria

• Persons suspected of funding terrorism and/or providing material assistance to

FTOs

The presence of any single incident of suspicious activity does not presume terrorist 

activity, but the presence of multiple activities may indicate criminal or terror plotting. As such, 

suspicious activity should never be discarded as unimportant and should be reported promptly. 

Given the inherent volatility of the world today and the current threat environment, it is 

imperative that we understand the threat of terrorism is not only present, but it is enduring. The 

best approach to countering the threat of violent attacks in the U.S. is through understanding and 

accepting the nature of the threat while exercising extreme vigilance. 

Should you observe activities that are suspicious in nature, please contact local law 

enforcement immediately and provide details of what you have witnessed. You may also call the 

Virginia Fusion Center (VFC) Suspicious Activity Tip Line at 1-877-4VA-TIPS or download the 

VFC See Something / Send Something app that is available for Android devices on Google Play 

and Apple devices at the App Store (see the icon below for further details). If you are located at 

a DLA installation, you may report suspicious activity by telephoning your local DLA Police 

Department or utilizing DLA’s suspicious activity reporting mechanism, which is “iWATCH 

DLA.” The iWATCH icon can be found on the DLA Today website. 

Submitted by:

Donald Bartlett, Investigative Analyst, Defense Supply Center Richmond, (804) 279-3385 office / donald.bartlett@dla.mil